API Key Security: Storage, Rotation and Leak Prevention

API keys are bearer credentials: whoever holds the key gets its access. They leak constantly, through code, logs, screenshots and client-side bundles, and attackers actively hunt for them.

How API keys leak

• Committed to code repositories, including public repos, forks and old commits.
• Embedded in frontend JavaScript or mobile apps, where anyone can extract them.
• In URLs, which end up in server logs, browser history and analytics.
• In logs and error trackers when full requests are recorded.
• In CI/CD output and build artifacts.
• Shared in chat, tickets and documentation.
• In container images pushed to public registries.

What attackers do with leaked keys

• Use cloud keys to launch compute for crypto mining or to steal data.
• Use payment, email or SMS provider keys to send fraud or spam.
• Use AI API keys to run up large bills.
• Use your own product's admin keys to access customer data.

Automated scanners watch public repositories and package registries for new secrets, so exposure can be exploited within minutes.

Best practices for issuing keys (if you run an API)

• Generate long, random keys from a cryptographically secure source.
• Use a recognisable prefix, such as acme_live_, so secret scanning tools can detect them.
• Store a hash, not the key, and display the full key once.
• Scope keys by permission, environment and resource.
• Support multiple active keys for zero-downtime rotation.
• Offer expiry and show last-used timestamps so customers can clean up.
• Join secret scanning partner programmes where code hosts offer them, so leaked keys are reported to you.

Best practices for using keys (in your apps)

1. Keep secrets in a secrets manager or your platform's encrypted environment variables.
2. Never put secret keys in client-side code. Proxy calls through your backend.
3. Use publishable or restricted keys where providers offer them, for client-side use.
4. Apply least privilege when creating keys with providers.
5. Rotate regularly and immediately after staff changes or suspected exposure.
6. Scan for secrets in pre-commit hooks and CI.

If a key leaks

1. Revoke or rotate immediately. Deleting the commit is not enough; history and forks keep it.
2. Check usage logs for activity since the leak.
3. Assess what data or actions were exposed.
4. Find the root cause and add controls to prevent recurrence.

Finding exposed keys

SecurityInfinity's secrets agent scans your frontend bundles, public repositories and exposed files for API keys and tokens, and its brand intelligence checks for leaked keys tied to your organisation. Start free.

Frequently asked questions

Is it safe to put an API key in environment variables?

Environment variables are better than code, but they can leak through logs, crash reports and debug pages. Use a secrets manager for high-value keys.

Are Firebase or Supabase public keys secret?

Their public client keys are designed to be exposed, but security then depends entirely on correctly configured security rules or row-level security.

How often should keys be rotated?

At least annually for low-risk keys, more often for high-privilege keys, and immediately after any suspected exposure.